Logstash Grok custom pattern

Elastic Stack Logstash
#1

Hi All,

I want to parse following log patterns with logstash:
2016-08-12 16:37:00,039 [8] ERROR OnlineService Object reference not set to an instance of an object.

As of now I have created following pattern:
%{TIMESTAMP_ISO8601:timestamp_match} %{GREEDYDATA:logs}

I need to extract timestamp(2016-08-12 16:37:00), code_1(039), code_2(8), log_level(ERROR),message(OnlineService Object reference not set to an instance of an object.) from log file to ingest into elasticsearch index.

Can anyone please help in above patter creation.

Regards,
Abhishek

#2

You want to extract the timestamp's milliseconds to a field named code_1?

Have you tried using http://grokconstructor.appspot.com/ ?

#3

Hi,

I've tried below pattern:
%{TIMESTAMP_ISO8601:timestamp},%{NUMBER:code1} [%{NUMBER:code2}] %{LOGLEVEL:log_level} %{GREEDYDATA:message}

And it served my purpose.
Although I will go through the link provided and explore more :slight_smile:

Thanks,
Abhishek

#4